[BUG] loglevel is ignored by by fund and audit on npm install

[bnb]

What / Why

Currently, when you run npm install <module> --silent (or any other log filter), both fund and audit are logged. (Credit where credit is due: Tweet)

When

• Audit: Whenever I npm install a module.
• Fund: Whenever I npm install a module that resolves a module with a fund property in its dependency tree.

Where

• npm/cli

Current Behavior

• console.log()s both fund and audit no matter

Steps to Reproduce

• n/a

Expected Behavior

• Both audit and fund should likely both be considered notice level logs and not appear in anything more strict than that (since notice is the default, this also makes sense with the current default behavior of both of them).

Credit where Credit is Due

[darcyclarke]

/xx @isaacs @ruyadorno has this come up before? I don't remember us talking about it. I'm guessing we could reuse how we implemented --no-audit & --no-fund (?)

[bnb]

@darcyclarke I think this may be a major change, depending on if people rely on the fund or audit output in the console.

[isaacs]

Yeah, we should skip those methods when loglevel is set to silent for sure.

I'd call this a bug, but as @bnb suggests, it's a SemVer-major fix. I'll get it done in the v7 branch right now.

[isaacs]

It's covered in v7. Closing now.